2026-08-06_4333201e353eb95207b0ff541fe0d17f_cobalt-strike_icedid_njrat_satacom_stealc

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-06_4333201e353eb95207b0ff541fe0d17f_cobalt-strike_icedid_njrat_satacom_stealc
Size 922KB
Sample260806-zktjcaam4z
SHA256 42bcbec2edf26ba9eae3e3c113c59122f1b72eca8a3c050a34b16d4e3310654c
MD5 4333201e353eb95207b0ff541fe0d17f
SHA1 f6dad64d6318b7e569e4fb1d6b9bce6b9b2fb01f
SHA512 bb5f358e23481f784c4ec6fe8ed0e577832675085447eff14014ace10175bd2972e47690adf3aace224d2a0d4a1a5b56cc482d64c1a1291ea2386dd1c4f2e691
SSDEEP 12288:48hWXVIvfKGyLTIEUmtOpo+JJaMXfLmxR8CH48ivUK0nPE2C5t6fvybFbNbSmb4J:CFsyRIakqULmj844RvUPcvl
TLSH
T109157C25B6A801F9E177C2B88AD34907F772B84707359ADB2394866B3F279D05E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-06_4333201e353eb95207b0ff541fe0d17f_cobalt-strike_icedid_njrat_satacom_stealc

File Explorer

2026-08-06_4333201e353eb95207b0ff541fe0d17f_cobalt-strike_icedid_njrat_satacom_stealc

.exe 922KB

2026-08-06_4333201e353eb95207b0ff541fe0d17f_cobalt-strike_icedid_njrat_satacom_stealc

IMPHASH 5764ef84ef87bf65e6aafa000baba23e
SHA256 42bcbec2edf26ba9eae3e3c113c59122f1b72eca8a3c050a34b16d4e3310654c
MD5 4333201e353eb95207b0ff541fe0d17f
SHA1 f6dad64d6318b7e569e4fb1d6b9bce6b9b2fb01f
SHA512 bb5f358e23481f784c4ec6fe8ed0e577832675085447eff14014ace10175bd2972e47690adf3aace224d2a0d4a1a5b56cc482d64c1a1291ea2386dd1c4f2e691
SSDEEP 12288:48hWXVIvfKGyLTIEUmtOpo+JJaMXfLmxR8CH48ivUK0nPE2C5t6fvybFbNbSmb4J:CFsyRIakqULmj844RvUPcvl
TLSH
T109157C25B6A801F9E177C2B88AD34907F772B84707359ADB2394866B3F279D05E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

450000

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

webview2loader

CreateCoreWebView2EnvironmentWithOptions

bcrypt

BCryptDestroyHash BCryptGetProperty BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData

winhttp

WinHttpSendRequest WinHttpConnect WinHttpQueryDataAvailable WinHttpSetOption WinHttpCloseHandle WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData

kernel32

GetCommandLineA HeapSize GetOEMCP GetACP IsValidCodePage HeapReAlloc SetFilePointerEx GetModuleFileNameA CreateSemaphoreExW HeapFree SetLastError ReleaseSemaphore GetModuleHandleExW InitializeCriticalSectionEx WaitForSingleObject GetCurrentThreadId ReleaseMutex FormatMessageW GetLastError OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW CloseHandle HeapAlloc DecodePointer GetProcAddress CreateMutexExW DeleteCriticalSection GetCurrentProcessId GetProcessHeap GetModuleHandleW WideCharToMultiByte DebugBreak IsDebuggerPresent ReadFile SizeofResource WriteFile CreateFileW GetFileAttributesW OpenProcess CreateToolhelp32Snapshot ReadConsoleW Sleep Process32NextW LockResource GetCommandLineW Process32FirstW LoadResource FindResourceW MoveFileExW GetFileSize IsWow64Process GetExitCodeProcess ResumeThread CreateProcessW GetLogicalDrives FindFirstFileW FindNextFileW FindClose GetDriveTypeW GetVolumeInformationW GetComputerNameA GetCurrentProcess TerminateProcess GetCurrentThread GetThreadContext GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW LoadLibraryExW VirtualProtect GetFileType GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FlsFree GetEnvironmentStringsW SetEnvironmentVariableW FreeEnvironmentStringsW DeleteFileW SetStdHandle WriteConsoleW SetEndOfFile MultiByteToWideChar InitializeCriticalSection FlsSetValue FlsGetValue FlsAlloc RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter RaiseException GetCPInfo CreateActCtxW GetTempPathW UnmapViewOfFile GetTempFileNameW CreateFileMappingW ReleaseActCtx MapViewOfFile Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection GetSystemTimeAsFileTime QueryPerformanceCounter EnterCriticalSection VirtualFree VirtualAlloc LeaveCriticalSection RtlUnwind GetModuleFileNameW LocalFree Thread32Next Thread32First GetNativeSystemInfo DuplicateHandle ResetEvent GetTickCount DeviceIoControl LoadLibraryW FreeLibrary GetSystemInfo VirtualAllocEx VirtualFreeEx ActivateActCtx GetEnvironmentVariableW GetSystemDirectoryW DeactivateActCtx GetSystemWow64DirectoryW Module32FirstW GetCurrentDirectoryW GetWindowsDirectoryW CreateNamedPipeW TerminateThread CreateThread GetExitCodeThread SuspendThread GetThreadTimes OpenThread WriteProcessMemory VirtualProtectEx ReadProcessMemory CreateRemoteThread SetThreadContext VirtualQueryEx FormatMessageA GetStringTypeW GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW CreateFile2 AreFileApisANSI GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive QueryPerformanceFrequency GetSystemTimePreciseAsFileTime SleepConditionVariableSRW EncodePointer LCMapStringEx WakeAllConditionVariable

user32

ReleaseCapture wsprintfW MessageBoxW UpdateWindow PostQuitMessage IsWindowVisible EnumWindows FindWindowW GetWindowTextW GetMessageW DefWindowProcW PostMessageW SetWindowLongPtrW SetWindowRgn CreateWindowExW SendMessageW GetSystemMetrics GetWindowLongPtrW RegisterClassExW ShowWindow DispatchMessageW TranslateMessage LoadCursorW GetClientRect

gdi32

CreateSolidBrush CreateRoundRectRgn

comdlg32

GetOpenFileNameW

advapi32

RegCloseKey LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken OpenThreadToken RegEnumValueW RegSetValueExW RegCreateKeyW RegOpenKeyW ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW RegQueryValueExW

shell32

SHGetPathFromIDListW SHGetFolderPathW SHBrowseForFolderW

ole32

CoInitializeEx CoTaskMemFree CoUninitialize CoCreateInstance CoInitialize

dwmapi

DwmSetWindowAttribute

shlwapi

SHDeleteKeyW

oleaut32

SysFreeString

??0Assembler@asmjit@@QEAA@PEAURuntime@1@@Z ??0CodeGen@asmjit@@QEAA@PEAURuntime@1@@Z ??0HostRuntime@asmjit@@QEAA@XZ ??0JitRuntime@asmjit@@QEAA@XZ ??0Runtime@asmjit@@QEAA@XZ ??0StaticRuntime@asmjit@@QEAA@PEAX_K@Z ??0VMemMgr@asmjit@@QEAA@PEAX@Z ??0X86Assembler@asmjit@@QEAA@PEAURuntime@1@I@Z ??0Zone@asmjit@@QEAA@_K@Z ??1Assembler@asmjit@@UEAA@XZ ??1CodeGen@asmjit@@UEAA@XZ ??1HostRuntime@asmjit@@UEAA@XZ ??1JitRuntime@asmjit@@UEAA@XZ ??1Runtime@asmjit@@UEAA@XZ ??1StaticRuntime@asmjit@@UEAA@XZ ??1VMemMgr@asmjit@@QEAA@XZ ??1X86Assembler@asmjit@@UEAA@XZ ??1Zone@asmjit@@QEAA@XZ ??_FVMemMgr@asmjit@@QEAAXXZ ?_alloc@Zone@asmjit@@QEAAPEAX_K@Z ?_emit@X86Assembler@asmjit@@UEAAIIAEBUOperand@2@000@Z ?_grow@Assembler@asmjit@@QEAAI_K@Z ?_grow@PodVectorBase@asmjit@@IEAAI_K0@Z ?_newLabel@Assembler@asmjit@@QEAAIPEAULabel@2@@Z ?_newLabelLink@Assembler@asmjit@@QEAAPEAULabelLink@2@XZ ?_nullData@PodVectorBase@asmjit@@2UPodVectorData@2@B ?_registerIndexedLabels@Assembler@asmjit@@QEAAI_K@Z ?_relocCode@X86Assembler@asmjit@@UEBA_KPEAX_K@Z ?_reserve@Assembler@asmjit@@QEAAI_K@Z ?_reserve@PodVectorBase@asmjit@@IEAAI_K0@Z ?_x86CondToCmovcc@asmjit@@3QBIB ?_x86CondToJcc@asmjit@@3QBIB ?_x86CondToSetcc@asmjit@@3QBIB ?_x86InstExtendedInfo@asmjit@@3QBUX86InstExtendedInfo@1@B ?_x86InstInfo@asmjit@@3QBUX86InstInfo@1@B ?_x86ReverseCond@asmjit@@3QBIB ?add@JitRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?add@StaticRuntime@asmjit@@UEAAIPEAPEAXPEAUAssembler@2@@Z ?align@X86Assembler@asmjit@@UEAAIII@Z ?alloc@VMemMgr@asmjit@@QEAAPEAX_KI@Z ?alloc@VMemUtil@asmjit@@SAPEAX_KPEA_KI@Z ?allocProcessMemory@VMemUtil@asmjit@@SAPEAXPEAX_KPEA_KI@Z ?allocZeroed@Zone@asmjit@@QEAAPEAX_K@Z ?bind@Assembler@asmjit@@UEAAIAEBULabel@2@@Z ?callCpuId@X86CpuUtil@asmjit@@SAXIIPEATX86CpuId@2@@Z ?detect@X86CpuUtil@asmjit@@SAXPEAUX86CpuInfo@2@@Z ?detectHwThreadsCount@CpuInfo@asmjit@@SAIXZ ?dup@Zone@asmjit@@QEAAPEAXPEBX_K@Z ?embed@Assembler@asmjit@@UEAAIPEBXI@Z ?embedLabel@X86Assembler@asmjit@@QEAAIAEBULabel@2@@Z ?emit@Assembler@asmjit@@QEAAII@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@00_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@0_K@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@H@Z ?emit@Assembler@asmjit@@QEAAIIAEBUOperand@2@_K@Z ?emit@Assembler@asmjit@@QEAAIIH@Z ?emit@Assembler@asmjit@@QEAAII_K@Z ?flush@HostRuntime@asmjit@@UEAAXPEAX_K@Z ?getCpuInfo@HostRuntime@asmjit@@UEAAPEBUCpuInfo@2@XZ ?getHost@CpuInfo@asmjit@@SAPEBU12@XZ ?getPageGranularity@VMemUtil@asmjit@@SA_KXZ ?getPageSize@VMemUtil@asmjit@@SA_KXZ ?getStackAlignment@HostRuntime@asmjit@@UEAAIXZ ?make@Assembler@asmjit@@UEAAPEAXXZ ?noOperand@asmjit@@3UOperand@1@B ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KAEBUX86Reg@2@IHI@Z ?ptr_abs@x86@asmjit@@YA?AUX86Mem@2@_KHI@Z ?release@JitRuntime@asmjit@@UEAAIPEAX@Z ?release@StaticRuntime@asmjit@@UEAAIPEAX@Z ?release@VMemMgr@asmjit@@QEAAIPEAX@Z ?release@VMemUtil@asmjit@@SAIPEAX_K@Z ?releaseProcessMemory@VMemUtil@asmjit@@SAIPEAX0_K@Z ?relocCode@Assembler@asmjit@@QEBA_KPEAX_K@Z ?reset@Assembler@asmjit@@QEAAX_N@Z ?reset@PodVectorBase@asmjit@@QEAAX_N@Z ?reset@VMemMgr@asmjit@@QEAAXXZ ?reset@Zone@asmjit@@QEAAX_N@Z ?sdup@Zone@asmjit@@QEAAPEADPEBD@Z ?setArch@X86Assembler@asmjit@@QEAAII@Z ?setError@CodeGen@asmjit@@QEAAIIPEBD@Z ?setErrorHandler@CodeGen@asmjit@@QEAAIPEAUErrorHandler@2@@Z ?sformat@Zone@asmjit@@QEAAPEADPEBDZZ ?shrink@VMemMgr@asmjit@@QEAAIPEAX_K@Z ?x86RegData@asmjit@@3UX86RegData@1@B

Name

.text

Size

641KB

Virtual Size

640KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

181KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2026-08-06_4333201e353eb95207b0ff541fe0d17f_cobalt-strike_icedid_njrat_satacom_stealc

webview2loader

bcrypt

winhttp

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

dwmapi

shlwapi

oleaut32

generic